The RT-66x Root of Trust IP are fully programmable, FIPS 140-3 compliant (or certified for the RT-660F) hardware security anti-tamper cores offering security by design for data center and other highly-secure applications. The RT-660 protects against a wide range of hardware and software attacks with state-of-the-art anti-tamper security techniques. The RT-660 is a security co-processor, built on a custom-designed 32-bit RISC-V architecture, along with dedicated secure memories.
The RT-660 offers superior anti-tamper attack protection through the implementation of Differential Power Analysis (DPA) countermeasures and state-of-the-art fault injection attack (FIA) protections. The RT-660 implements DPA and FIA protected AES, RSA, and ECC cryptographic accelerator cores. The RT-660 provides hardware implementations of a NIST SP800-90a/b/c compliant TRNG (true random number generator), Public Key Engine (RSA up to 8192 bits and ECC up to 521 bits), AES (all modes), HMAC and SHA-2/-3 crypto accelerators.
The RT-661 adds the OSCCA SM2/3/4 Chinese cryptographic accelerators. The RT-664 takes the robust feature set of the RT-660 and adds a Quantum Safe Engine with FIPS 203 ML-KEM (CRYSTALS-Kyber) and FIPS 204 ML-DSA (CRYSTALS-Dilithium), as well as XMSS and LMS stateful hash acceleration, to safeguard against quantum computer attacks.
The RT-66x IP are the ideal choice for chip and system architects designing FPGA and ASIC solutions for applications requiring the highest level of security.
How the Root of Trust Works
While built upon a RISC-V architecture, the RT-660 RISC-V CPU is a custom implementation designed specifically for security use cases. Rambus employed over 20 years of device security experience to build a security co-processor providing the highest levels of siloed and layered security. The RT-660 is designed for integration into government ASICs and FPGAs, offering secure execution of authenticated user applications, tamper detection and protection, and secure storage and handling of keys and security assets.
The Root of Trust offers a siloed approach to security. While located on the same silicon as the main processor, the secure processing core is physically separated. A layered security approach enforces access to crypto modules, memory ranges, I/O pins, and other resources, and assures critical keys are available through hardware only with no access by software. The Rambus Root of Trust RT-660 supports all commonly deployed host SoC processor architectures, including ARM, RISC-V, x86 and others.
The Rambus Root of Trust supports multi-tenant deployments by offering true multiple root of trust capabilities. Each individual Secure Application can be assigned its own unique keys, meaning permissions and access levels are set completely independent of others. Secure Applications are siloed from each other, ensuring the best approach to security. OEMs can determine access levels and permissions for each and all processes operating within the secure processor.
Dedicated FPGA Configuration
The RT-660 is available in an FPGA configuration for synthesis in programmable logic. This configuration is designed to map optimally (for maximum utilization and frequency) into an FPGA fabric and connect either to on-board or external CPUs. In addition, the RT-660 is expanded with an additional OTP emulation model to overcome the lack of (or limitation of) true nonvolatile one-time programmable memory in certain FPGA families. This module allows storing secure assets in external flash in a secure way.
Secure Applications
Included with the RT-66x Hardware Root of Trust IP are a series of standard secure applications (“containers”) to speed development, including secure boot, identity management, HSM reference, and others. A container development kit (CSDK) is also included to allow the development of custom containers for specific use cases.
Rambus can optionally offer dedicated FIPS 140-3 support packages to its licensees that provide FIPS 140-3 related certification documentation, FIPS test scripts, and dedicated FIPS support.
Deep Anti-Tamper Experience
As the inventor and pioneer of DPA and an acknowledged leader in device security, Rambus is uniquely qualified to provide anti-tamper solutions for the most stringent requirements. Rambus technologies protect more than 9 billion chips per year, and as a US-based, independent company, Rambus has the experience and pedigree to be the solution provider of choice. Rambus has for more than 20 years supplied solutions for government and defense applications, including anti-tamper cores, software libraries, and testing workstations.
